Airflow@* Security Vulnerabilities and Issues — Airflow@* CVE List

Lucene search

ApacheAirflow*

12 matches found

CVE•added 2020/07/17 12:15 a.m.•1052 views

CVE-2020-11978

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on...

8.8CVSS9.1AI score0.94164EPSS

CVE•added 2020/11/10 4:15 p.m.•1036 views

CVE-2020-13927

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache....

9.8CVSS9.2AI score0.94161EPSS

CVE•added 2020/07/17 12:15 a.m.•105 views

CVE-2020-11981

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

9.8CVSS9.3AI score0.90743EPSS

CVE•added 2020/12/21 5:15 p.m.•98 views

CVE-2020-17526

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have change...

7.7CVSS7.4AI score0.90856EPSS

CVE•added 2020/09/17 2:15 p.m.•91 views

CVE-2020-13944

In Apache Airflow

6.1CVSS5.8AI score0.12588EPSS

CVE•added 2020/12/11 2:15 p.m.•81 views

CVE-2020-17515

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.

6.1CVSS5.9AI score0.12588EPSS

CVE•added 2020/07/17 12:15 a.m.•80 views

CVE-2020-11982

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code exec...

9.8CVSS9.4AI score0.05664EPSS

CVE•added 2020/07/17 12:15 a.m.•75 views

CVE-2020-11983

An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.

5.4CVSS5AI score0.00411EPSS

CVE•added 2020/07/17 12:15 a.m.•75 views

CVE-2020-9485

An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.

6.1CVSS5.8AI score0.02134EPSS

CVE•added 2020/12/14 10:15 a.m.•69 views

CVE-2020-17513

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

5.3CVSS5.5AI score0.00916EPSS

CVE•added 2020/01/14 5:15 p.m.•60 views

CVE-2019-12398

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.

4.8CVSS5.5AI score0.0067EPSS

CVE•added 2020/12/14 10:15 a.m.•60 views

CVE-2020-17511

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.

6.5CVSS6.3AI score0.00105EPSS